The headers that matter most
Strict-Transport-Security makes browsers use HTTPS for your site every time. Content-Security-Policy lists where scripts, styles and frames may come from, so injected code has a hard time running. X-Frame-Options or CSP frame-ancestors stops other sites from loading yours in a hidden frame. X-Content-Type-Options: nosniff stops browsers guessing file types, and Referrer-Policy and Permissions-Policy limit what leaks to other sites and which browser features pages can use.
How the grade works
Every check starts as a pass. HTTPS, HSTS and CSP count most; frame protection, nosniff and cookie flags count next; referrer and permissions policies and version numbers in headers count least. A warning costs half as much as a fail. The grade is a quick summary, so read each line: a strict CSP with a short HSTS time can still be a very well protected site.
Where to set headers
On Cloudflare Pages and Netlify, add them to a _headers file. On Vercel, use the headers section of vercel.json. With nginx use add_header, with Apache use Header always set, and in Node frameworks a small middleware works. Set them on every HTML response, not only the homepage.